What is DKIM?

DKIM is the email authentication standard that lets a receiving server confirm two things: that a message really was sent by your domain, and that it was not altered on the way. DKIM stands for DomainKeys Identified Mail, and it works by adding a cryptographic signature to every message you send, which anyone can verify using a public key you publish in DNS. Alongside SPF and DMARC, it is one of the three records every sending domain should have.

What is DKIM and why does it matter?

A DKIM signature is tamper-evident proof of origin. When your mail server signs a message, it uses a private key that only you hold. The receiving server fetches the matching public key from your DNS and checks the signature. If it verifies, the recipient knows the message genuinely came from your domain and that its content and key headers were not changed in transit. This makes impersonation far harder and tells mailbox providers your mail is trustworthy, which helps it reach the inbox.

How DKIM works

DKIM relies on a pair of keys. The private key stays secret on your sending server and is used to generate a signature over the message. The public key is published as a DNS TXT record so any receiver can read it. Because only the private key can produce a signature that the public key validates, a valid DKIM signature is strong evidence that the message is authentic. If even a signed header or the body is modified, the signature no longer matches and DKIM fails.

Selectors and key rotation

Each DKIM key is published under a selector, a label that lets a domain run several keys at once, for example one per sending service. The signature names the selector so the receiver knows which public key to fetch. Selectors also make key rotation easy: you publish a new key under a new selector, switch your signing to it, and retire the old one. Rotating keys periodically is good practice, because it limits the damage if a private key is ever exposed.

DKIM key strength

DKIM keys should be at least 2048 bits. Older 1024-bit keys still work but are weaker, and many providers now recommend or require the stronger length. When you set up or rotate DKIM, choosing a 2048-bit key is a simple way to stay on the safe side for years.

Why DKIM succeeds where SPF struggles

SPF checks the connecting server, which means it breaks when a message is forwarded through another system. DKIM travels with the message itself, so its signature survives most forwarding intact. This is why DKIM is often the more reliable of the two authentication paths under a DMARC policy. To see how they compare, read our guide on SPF vs DKIM vs DMARC, and the explainers on SPF and DMARC.

DKIM and DMARC alignment

For DKIM to satisfy DMARC, the signing domain must align with the domain in your visible from address. A message can carry a valid DKIM signature and still fail DMARC if that signature is from an unrelated domain. When you enable DKIM through a third-party service, make sure it signs as your own domain, not the provider’s, so alignment holds.

How to check your DKIM setup

DKIM problems are easy to miss because a message can be delivered while quietly failing authentication. Run a security scan with EzyAudit AI to confirm that DKIM is published, that your keys are strong enough, and that signing aligns with your DMARC policy, all explained without jargon. Review the full list of checks we run. For the technical specification, DKIM is defined in IETF RFC 6376.

A correctly signed domain is much harder to impersonate and much more likely to reach the inbox. Scan your website now to see whether your DKIM is set up correctly.